@protobase/client 0.7.0 → 0.8.0

package/dist/auth-types.d.ts

@@ -26,7 +26,7 @@ export type PlatformSignIn = {
  * `needsAdmin` while no user exists yet; `signInMethods` the ways to sign in the server's policy leaves on;
  * `passwordReset` when the server can email reset links; `socialProviders` the ids of the sign-in providers, for example
  * `github`; `platformSignIn` the one of them the platform adds; `staffSignIn` the operator provider's name when its staff
- * can sign in as people.
+ * can sign in as people; `organizations` when the app has them.
  */
 export type SetupStatus = {
   needsAdmin: boolean;
@@ -35,5 +35,17 @@ export type SetupStatus = {
   socialProviders: string[];
   platformSignIn?: PlatformSignIn;
   staffSignIn?: string;
+  /** With organizations: who may create them, and every role with its label, `membership` for those a member can hold. */
+  organizations?: {
+    create: 'admins' | 'everyone';
+    roles: RoleLabel[];
+  };
+};
+/** A role with its label; `membership` when a member can hold it, `grants` the other roles its holders may give. */
+export type RoleLabel = {
+  name: string;
+  label: string;
+  membership: boolean;
+  grants: string[];
 };
 //#endregion

package/dist/auth.d.ts

@@ -1,5 +1,6 @@
 import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
 import { AccountSignIn, AuthenticatorSetup, Passkey } from "./account-security.js";
+import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole } from "./organizations.js";
 import { StaffSignIn } from "./staff-sign-in.js";
 import { AuthUser, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
@@ -20,7 +21,8 @@ export declare const tokenExpiry: (token: string) => number;
 /**
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
  * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
- * sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), and a short-lived
+ * sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
+ * (`organizations`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
  */
 export declare const createAuthSession: (options?: AuthSessionOptions) => {
@@ -52,6 +54,44 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
     linkProvider: (provider: string, callbackURL: string) => Promise<string>;
     newBackupCodes: (password?: string) => Promise<string[]>;
   };
+  organizations: {
+    list: () => Promise<Organization[]>;
+    current: () => Promise<CurrentOrganization>;
+    switchTo: (organizationId: string | null) => Promise<{
+      organizationId: string | null;
+    }>;
+    search: (query: string) => Promise<Organization[]>;
+    create: (input: {
+      name: string;
+      slug: string;
+    }) => Promise<Organization>;
+    rename: (organizationId: string, data: {
+      name?: string;
+      slug?: string;
+    }) => Promise<Organization>;
+    remove: (organizationId: string) => Promise<Organization>;
+    leave: (organizationId: string) => Promise<unknown>;
+    members: (organizationId: string) => Promise<OrganizationMember[]>;
+    setRole: (organizationId: string, memberId: string, role: OrganizationRole) => Promise<unknown>;
+    setAppRoles: (memberId: string, appRoles: string[]) => Promise<unknown>;
+    removeMember: (organizationId: string, memberId: string) => Promise<unknown>;
+    transferOwnership: (memberId: string, keepAs?: "admin" | "member") => Promise<unknown>;
+    invitations: (organizationId: string) => Promise<OrganizationInvitation[]>;
+    invite: (organizationId: string, input: {
+      email: string;
+      role: OrganizationRole;
+      appRoles: string[];
+    }) => Promise<InvitationSent>;
+    resend: (organizationId: string, sent: Pick<OrganizationInvitation, "email" | "role">) => Promise<InvitationSent>;
+    revoke: (invitationId: string) => Promise<unknown>;
+    myInvitations: () => Promise<OrganizationInvitation[]>;
+    invitation: (token: string) => Promise<InvitationPreview>;
+    accept: (token: string) => Promise<unknown>;
+    signUpFromInvitation: (token: string, input: {
+      name: string;
+      password?: string;
+    }) => Promise<unknown>;
+  };
   signInPolicy: {
     read: () => Promise<SignInPolicyState>;
     save: (policy: SignInPolicy) => Promise<SignInPolicyState>;

package/dist/auth.js

@@ -1,6 +1,7 @@
 import { AuthError, authError } from "./auth-error.js";
 import { accountSecurity } from "./account-security.js";
 import { betterAuthClient } from "./better-auth-client.js";
+import { organizationsClient } from "./organizations.js";
 import { signInFlows } from "./sign-in-flows.js";
 import { signInPolicyClient } from "./sign-in-policy.js";
 import { staffSignInClient } from "./staff-sign-in.js";
@@ -16,7 +17,8 @@ const tokenExpiry = (token) => {
 /**
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
 * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
-* sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), and a short-lived
+* sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
+* (`organizations`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
 */
 const createAuthSession = (options = {}) => {
@@ -72,7 +74,8 @@ const createAuthSession = (options = {}) => {
 				passwordReset: Boolean(body.passwordReset),
 				socialProviders: body.socialProviders ?? [],
 				...body.platformSignIn && { platformSignIn: body.platformSignIn },
-				...body.staffSignIn && { staffSignIn: body.staffSignIn }
+				...body.staffSignIn && { staffSignIn: body.staffSignIn },
+				...body.organizations && { organizations: body.organizations }
 			};
 		},
 		/** The signed-in user from the session cookie, or `undefined`. */
@@ -120,6 +123,7 @@ const createAuthSession = (options = {}) => {
 			if (error) throw authError(error, "Could not set the password");
 		},
 		account: accountSecurity(client),
+		organizations: organizationsClient(client, () => token({ refresh: true })),
 		signInPolicy: signInPolicyClient(client),
 		staff: {
 			...staff,

package/dist/client.d.ts

@@ -1,8 +1,41 @@
 import { FilterInput, ListParams } from "./query-string.js";
 import { ClientOptions } from "./transport.js";
+import { UploadProgress } from "./upload-request.js";
 import { BatchOp, BatchResult, Facet, Histogram, ListPage, MetaResult, RecordOf, ResourceRef, Series, SeriesParams, Stored } from "./types.js";
 import { KeyValue } from "@protobase/schema";
 //#region src/client.d.ts
+/** How `invoke` calls a function: GET without a body, POST with one, unless `method` says otherwise. */
+export type InvokeOptions = {
+  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+  /** Sent as JSON. */
+  body?: unknown;
+  /** Below the function, such as `/42` for `/api/functions/<name>/42`. */
+  path?: string;
+  query?: Record<string, string>;
+  headers?: Record<string, string>;
+};
+/** What `upload` answers: `value` is the ticket to send as the field's value in a create, update or batch write. */
+export type UploadResult = {
+  value: string;
+  /** The type is the one detected from the content. */
+  file: {
+    name: string;
+    type: string;
+    size: number;
+  };
+  /** Values the field's processors computed for other fields; the write stores them with the file. */
+  derived: Record<string, unknown>;
+  /** Set when the content's type differs from what the name or browser said: `photo.png` that is a JPEG. */
+  corrected?: {
+    from: string;
+    to: string;
+  };
+};
+export type UploadOptions = {
+  /** Reports bytes sent; uses XMLHttpRequest where there is one, since fetch reports no upload progress. */
+  onProgress?: UploadProgress;
+  signal?: AbortSignal;
+};
 export declare const createClient: (options?: ClientOptions) => {
   list: <R extends ResourceRef>(resource: R, params?: ListParams) => Promise<ListPage<RecordOf<R>>>;
   search: <R extends ResourceRef>(resource: R, params?: ListParams) => Promise<ListPage<RecordOf<R>>>;
@@ -32,6 +65,8 @@ export declare const createClient: (options?: ClientOptions) => {
     position: number;
   }) => Promise<ListPage<RecordOf<R>>>;
   meta: (etag?: string) => Promise<MetaResult>;
+  invoke: <T = unknown>(name: string, { method, body, path, query, headers }?: InvokeOptions) => Promise<T>;
+  upload: (resource: ResourceRef, field: string, file: Blob, { onProgress, signal }?: UploadOptions) => Promise<UploadResult>;
 };
 export type Client = ReturnType<typeof createClient>;
 //#endregion

package/dist/client.js

@@ -1,5 +1,6 @@
 import { filterText, listWire, queryString } from "./query-string.js";
 import { createTransport } from "./transport.js";
+import { fetchWithProgress } from "./upload-request.js";
 import { encodeKey } from "@protobase/schema";
 //#region src/client.ts
 const nameOf = (resource) => typeof resource === "string" ? resource : resource.toModel().name;
@@ -185,6 +186,44 @@ const createClient = (options = {}) => {
 			etag: etagOf(response)
 		};
 	};
+	/**
+	* Calls one of the app's API functions, `/api/functions/<name>`, with the user's token. Resolves to its answer: parsed
+	* JSON, text, or `undefined` for a 204. A problem rejects as from any other call.
+	*/
+	const invoke = async (name, { method, body, path = "", query, headers } = {}) => {
+		const response = await send({
+			method: method ?? (body === void 0 ? "GET" : "POST"),
+			path: `/functions/${encodeURIComponent(name)}${path}`,
+			query: query ? `?${new URLSearchParams(query)}` : "",
+			body,
+			headers,
+			system: true
+		});
+		if (response.status === 204) return void 0;
+		return response.headers.get("content-type")?.includes("json") ? response.json() : response.text();
+	};
+	/**
+	* Uploads a file for a file field (`POST /{resource}:upload`). Send `value` of the result as the field's value in a
+	* create, update or batch write within 24 hours; the server detects the type and refuses one the field does not take.
+	*/
+	const upload = async (resource, field, file, { onProgress, signal } = {}) => {
+		const name = "name" in file && typeof file.name === "string" ? file.name : void 0;
+		const progress = onProgress && typeof XMLHttpRequest !== "undefined" ? fetchWithProgress(onProgress) : void 0;
+		const result = await (await send({
+			method: "POST",
+			path: `/${nameOf(resource)}:upload`,
+			query: `?${new URLSearchParams({
+				field,
+				...name !== void 0 && { name }
+			})}`,
+			raw: file,
+			headers: { "content-type": file.type || "application/octet-stream" },
+			...progress && { via: progress },
+			...signal && { signal }
+		})).json();
+		onProgress?.(file.size, file.size);
+		return result;
+	};
 	return {
 		list,
 		search,
@@ -199,7 +238,9 @@ const createClient = (options = {}) => {
 		series,
 		histogram,
 		seek,
-		meta
+		meta,
+		invoke,
+		upload
 	};
 };
 //#endregion

package/dist/index.d.ts

@@ -1,15 +1,17 @@
 import { FilterInput, ListParams, filterText, listWire } from "./query-string.js";
 import { ClientOptions } from "./transport.js";
-import { BatchOp, BatchRef, BatchResult, Facet, Histogram, HistogramBucket, ListPage, Meta, MetaResult, RecordOf, RecordPermissions, ResourcePermissions, ResourceRef, Series, SeriesParams, SeriesPoint, Stored } from "./types.js";
-import { Client, createClient } from "./client.js";
+import { UploadProgress } from "./upload-request.js";
+import { BatchOp, BatchRef, BatchResult, Facet, Histogram, HistogramBucket, ListPage, Meta, MetaResult, RecordOf, RecordPermissions, ResourcePermissions, ResourceRef, Series, SeriesParams, SeriesPoint, Stored, StoredFile } from "./types.js";
+import { Client, InvokeOptions, UploadOptions, UploadResult, createClient } from "./client.js";
 import { ApiError, PreconditionFailedError, ProblemDetails, ProblemError, isApiError } from "./problem.js";
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
+import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient } from "./organizations.js";
 import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
-import { AuthUser, PlatformSignIn, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
+import { AuthUser, PlatformSignIn, RoleLabel, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
 import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from "./auth.js";
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimePolicy, RuntimeStatus, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type Facet, type FilterInput, type Histogram, type HistogramBucket, type ListPage, type ListParams, type Meta, type MetaResult, type Passkey, type PlatformSignIn, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type TwoFactorMethod, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CurrentOrganization, type Facet, type FilterInput, type Histogram, type HistogramBucket, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type Passkey, type PlatformSignIn, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };

package/dist/organizations.d.ts

@@ -0,0 +1,119 @@
+import { BetterAuthClient } from "./better-auth-client.js";
+//#region src/organizations.d.ts
+/** Who manages an organization: owners everything, admins its members and details, members nothing. */
+export type OrganizationRole = 'owner' | 'admin' | 'member';
+export type Organization = {
+  id: string;
+  name: string;
+  slug: string;
+  logo?: string | null;
+};
+/**
+ * The organization the session works in: for a member with their organization role, app roles there and membership
+ * id; for someone with a global role who entered it without being a member, without them. `globalRoles` are the
+ * person's roles in every organization.
+ */
+export type CurrentOrganization = {
+  organization: Organization | null;
+  role?: OrganizationRole;
+  appRoles?: string[];
+  memberId?: string;
+  globalRoles: string[];
+};
+export type OrganizationMember = {
+  id: string;
+  userId: string;
+  name: string;
+  email: string;
+  role: OrganizationRole;
+  appRoles: string[];
+  createdAt: string;
+};
+/** `organizationName` comes with the person's own invitations, which span organizations. */
+export type OrganizationInvitation = {
+  id: string;
+  email: string;
+  role: OrganizationRole;
+  appRoles: string[];
+  status: string;
+  expiresAt: string;
+  organizationName?: string;
+};
+/** An invitation as its link shows it, before it is accepted. */
+export type InvitationPreview = {
+  organization: {
+    id: string;
+    name: string;
+  };
+  inviter: {
+    name: string;
+  };
+  email: string;
+  role: OrganizationRole;
+  appRoles: string[];
+  expiresAt: string;
+  hasAccount: boolean;
+};
+/** What inviting gives back: the invitation, and its link when the server cannot email it. */
+export type InvitationSent = {
+  invitation: OrganizationInvitation;
+  link?: string;
+};
+/**
+ * The signed-in person's organizations: switching, creating and managing them, their members and invitations, and
+ * invitation links. A change of the organization one works in fetches a new token at once (`refreshToken`), since the
+ * token names it. Each call rejects with `AuthError`.
+ */
+export declare const organizationsClient: (client: BetterAuthClient, refreshToken: () => Promise<unknown>) => {
+  /** The organizations the person is a member of. */
+  list: () => Promise<Organization[]>;
+  current: () => Promise<CurrentOrganization>;
+  /** Works in another organization from now on; `null` for none. */
+  switchTo: (organizationId: string | null) => Promise<{
+    organizationId: string | null;
+  }>;
+  /** Every organization whose name or slug contains `query`, for people with a global role. */
+  search: (query: string) => Promise<Organization[]>;
+  /** Creates an organization, owned by the person with every app role, and works in it. */
+  create: (input: {
+    name: string;
+    slug: string;
+  }) => Promise<Organization>;
+  rename: (organizationId: string, data: {
+    name?: string;
+    slug?: string;
+  }) => Promise<Organization>;
+  /** Deletes an organization; the server refuses one that still has records. */
+  remove: (organizationId: string) => Promise<Organization>;
+  leave: (organizationId: string) => Promise<unknown>;
+  members: (organizationId: string) => Promise<OrganizationMember[]>;
+  setRole: (organizationId: string, memberId: string, role: OrganizationRole) => Promise<unknown>;
+  /** Sets a member's app roles; only the roles the person may give can change. */
+  setAppRoles: (memberId: string, appRoles: string[]) => Promise<unknown>;
+  removeMember: (organizationId: string, memberId: string) => Promise<unknown>;
+  /** Hands the organization over to a member; the person stays as `keepAs`, an admin unless said otherwise. */
+  transferOwnership: (memberId: string, keepAs?: "admin" | "member") => Promise<unknown>;
+  invitations: (organizationId: string) => Promise<OrganizationInvitation[]>;
+  /** Invites an address; the link comes back only when the server cannot email it. */
+  invite: (organizationId: string, input: {
+    email: string;
+    role: OrganizationRole;
+    appRoles: string[];
+  }) => Promise<InvitationSent>;
+  /** Sends an invitation again with a new link, which voids the earlier one. */
+  resend: (organizationId: string, sent: Pick<OrganizationInvitation, "email" | "role">) => Promise<InvitationSent>;
+  revoke: (invitationId: string) => Promise<unknown>;
+  /** The pending invitations for the person's own address. */
+  myInvitations: () => Promise<OrganizationInvitation[]>;
+  /** What an invitation link is for; works signed out. */
+  invitation: (token: string) => Promise<InvitationPreview>;
+  /** Accepts an invitation signed in as its address, and works in its organization. */
+  accept: (token: string) => Promise<unknown>;
+  /** Creates an account for an invited address without one, accepts the invitation and signs in. */
+  signUpFromInvitation: (token: string, input: {
+    name: string;
+    password?: string;
+  }) => Promise<unknown>;
+};
+export type OrganizationsClient = ReturnType<typeof organizationsClient>;
+//#endregion

package/dist/organizations.js

@@ -0,0 +1,125 @@
+import { authError } from "./auth-error.js";
+//#region src/organizations.ts
+const rolesOf = (value) => Array.isArray(value) ? value.filter((name) => typeof name === "string") : typeof value === "string" ? JSON.parse(value) : [];
+const organizationRole = (role) => {
+	const roles = role.split(",");
+	return roles.includes("owner") ? "owner" : roles.includes("admin") ? "admin" : "member";
+};
+const member = (raw) => ({
+	id: raw.id,
+	userId: raw.userId,
+	name: raw.user.name || raw.user.email,
+	email: raw.user.email,
+	role: organizationRole(raw.role),
+	appRoles: rolesOf(raw.appRoles),
+	createdAt: new Date(raw.createdAt).toISOString()
+});
+const invitation = (raw) => ({
+	id: raw.id,
+	email: raw.email,
+	role: organizationRole(raw.role),
+	appRoles: rolesOf(raw.appRoles),
+	status: raw.status,
+	expiresAt: new Date(raw.expiresAt).toISOString(),
+	...raw.organizationName && { organizationName: raw.organizationName }
+});
+/**
+* The signed-in person's organizations: switching, creating and managing them, their members and invitations, and
+* invitation links. A change of the organization one works in fetches a new token at once (`refreshToken`), since the
+* token names it. Each call rejects with `AuthError`.
+*/
+const organizationsClient = (client, refreshToken) => {
+	const call = async (path, fallback, init = {}) => {
+		const { data, error } = await client.$fetch(path, {
+			method: init.method ?? (init.body ? "POST" : "GET"),
+			...init.body && { body: init.body },
+			...init.query && { query: init.query }
+		});
+		if (error) throw authError(error, fallback);
+		return data;
+	};
+	const thenRefresh = async (result) => {
+		await refreshToken();
+		return result;
+	};
+	return {
+		/** The organizations the person is a member of. */
+		list: async () => await call("/organization/list", "Could not read your organizations") ?? [],
+		current: () => call("/organization/current", "Could not read the current organization"),
+		/** Works in another organization from now on; `null` for none. */
+		switchTo: async (organizationId) => thenRefresh(await call("/organization/switch", "Could not switch the organization", { body: { organizationId } })),
+		/** Every organization whose name or slug contains `query`, for people with a global role. */
+		search: async (query) => (await call("/organization/search", "Could not search the organizations", { query: { query } })).organizations,
+		/** Creates an organization, owned by the person with every app role, and works in it. */
+		create: async (input) => thenRefresh(await call("/organization/create", "Could not create the organization", { body: input })),
+		rename: (organizationId, data) => call("/organization/update", "Could not change the organization", { body: {
+			organizationId,
+			data
+		} }),
+		/** Deletes an organization; the server refuses one that still has records. */
+		remove: async (organizationId) => thenRefresh(await call("/organization/delete", "Could not delete the organization", { body: { organizationId } })),
+		leave: async (organizationId) => thenRefresh(await call("/organization/leave", "Could not leave the organization", { body: { organizationId } })),
+		members: async (organizationId) => (await call("/organization/list-members", "Could not read the members", { query: {
+			organizationId,
+			limit: "1000"
+		} })).members.map(member),
+		setRole: (organizationId, memberId, role) => call("/organization/update-member-role", "Could not change the role", { body: {
+			organizationId,
+			memberId,
+			role
+		} }),
+		/** Sets a member's app roles; only the roles the person may give can change. */
+		setAppRoles: (memberId, appRoles) => call("/organization/set-app-roles", "Could not change the app roles", { body: {
+			memberId,
+			appRoles
+		} }),
+		removeMember: (organizationId, memberId) => call("/organization/remove-member", "Could not remove the member", { body: {
+			organizationId,
+			memberIdOrEmail: memberId
+		} }),
+		/** Hands the organization over to a member; the person stays as `keepAs`, an admin unless said otherwise. */
+		transferOwnership: (memberId, keepAs = "admin") => call("/organization/transfer-ownership", "Could not hand the organization over", { body: {
+			memberId,
+			keepAs
+		} }),
+		invitations: async (organizationId) => (await call("/organization/list-invitations", "Could not read the invitations", { query: { organizationId } }) ?? []).map(invitation),
+		/** Invites an address; the link comes back only when the server cannot email it. */
+		invite: async (organizationId, input) => {
+			const raw = await call("/organization/invite-member", "Could not send the invitation", { body: {
+				organizationId,
+				...input
+			} });
+			return {
+				invitation: invitation(raw),
+				...raw.link && { link: raw.link }
+			};
+		},
+		/** Sends an invitation again with a new link, which voids the earlier one. */
+		resend: async (organizationId, sent) => {
+			const raw = await call("/organization/invite-member", "Could not send the invitation again", { body: {
+				organizationId,
+				email: sent.email,
+				role: sent.role,
+				resend: true
+			} });
+			return {
+				invitation: invitation(raw),
+				...raw.link && { link: raw.link }
+			};
+		},
+		revoke: (invitationId) => call("/organization/cancel-invitation", "Could not revoke the invitation", { body: { invitationId } }),
+		/** The pending invitations for the person's own address. */
+		myInvitations: async () => (await call("/organization/list-user-invitations", "Could not read your invitations") ?? []).map(invitation),
+		/** What an invitation link is for; works signed out. */
+		invitation: (token) => call("/invitation", "This invitation link is not valid", { query: { token } }),
+		/** Accepts an invitation signed in as its address, and works in its organization. */
+		accept: async (token) => thenRefresh(await call("/invitation/accept", "Could not accept the invitation", { body: { token } })),
+		/** Creates an account for an invited address without one, accepts the invitation and signs in. */
+		signUpFromInvitation: async (token, input) => thenRefresh(await call("/invitation/sign-up", "Could not create your account", { body: {
+			token,
+			...input
+		} }))
+	};
+};
+//#endregion
+export { organizationsClient };

package/dist/static-session.d.ts

@@ -4,7 +4,7 @@ import { AuthSession } from "./auth.js";
 /**
  * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
  * It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
- * passkeys, two-factor authentication or the sign-in policy, and is never a staff session.
+ * passkeys, two-factor authentication, the sign-in policy or organizations, and is never a staff session.
  */
 export declare const createStaticSession: (token: string, user?: AuthUser) => AuthSession;
 //#endregion

package/dist/static-session.js

@@ -6,7 +6,7 @@ const unsupported = (what) => async () => {
 /**
 * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
 * It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
-* passkeys, two-factor authentication or the sign-in policy, and is never a staff session.
+* passkeys, two-factor authentication, the sign-in policy or organizations, and is never a staff session.
 */
 const createStaticSession = (token, user = {
 	id: "token",
@@ -78,6 +78,32 @@ const createStaticSession = (token, user = {
 		current: async () => void 0,
 		stop: unsupported("end a staff session"),
 		log: unsupported("read the staff sign-ins")
+	},
+	organizations: {
+		list: async () => [],
+		current: async () => ({
+			organization: null,
+			globalRoles: []
+		}),
+		switchTo: unsupported("switch organizations"),
+		search: async () => [],
+		create: unsupported("create an organization"),
+		rename: unsupported("change an organization"),
+		remove: unsupported("delete an organization"),
+		leave: unsupported("leave an organization"),
+		members: async () => [],
+		setRole: unsupported("change a role"),
+		setAppRoles: unsupported("change app roles"),
+		removeMember: unsupported("remove a member"),
+		transferOwnership: unsupported("hand an organization over"),
+		invitations: async () => [],
+		invite: unsupported("invite people"),
+		resend: unsupported("invite people"),
+		revoke: unsupported("revoke an invitation"),
+		myInvitations: async () => [],
+		invitation: unsupported("read an invitation"),
+		accept: unsupported("accept an invitation"),
+		signUpFromInvitation: unsupported("accept an invitation")
 	}
 });
 //#endregion

package/dist/transport.js

@@ -4,10 +4,10 @@ const createTransport = (options = {}) => {
 	const baseUrl = options.baseUrl ?? "/api/v1";
 	const systemUrl = baseUrl.replace(/\/[^/]*$/, "");
 	const doFetch = options.fetch ?? ((input, init) => fetch(input, init));
-	return async ({ method, path, query = "", body, headers, accept = [], system }) => {
+	return async ({ method, path, query = "", body, headers, accept = [], system, raw, via, signal }) => {
 		const attempt = async (refresh) => {
 			const token = await options.token?.({ refresh });
-			return doFetch(`${system ? systemUrl : baseUrl}${path}${query}`, {
+			return (via ?? doFetch)(`${system ? systemUrl : baseUrl}${path}${query}`, {
 				method,
 				headers: {
 					...body !== void 0 && { "content-type": "application/json" },
@@ -15,7 +15,8 @@ const createTransport = (options = {}) => {
 					...options.headers?.(),
 					...headers
 				},
-				body: body === void 0 ? void 0 : JSON.stringify(body)
+				body: raw ?? (body === void 0 ? void 0 : JSON.stringify(body)),
+				...signal && { signal }
 			});
 		};
 		let response = await attempt(false);

package/dist/types.d.ts

@@ -97,6 +97,20 @@ export type Stored<T> = {
   etag: string;
   permissions?: RecordPermissions;
 };
+/**
+ * A file field as records carry it. `url` downloads it: signed and valid one to two hours for a private file, permanent
+ * for a public one. Send `uri` back unchanged to keep the file, or `null` to clear it.
+ */
+export type StoredFile = {
+  uri: string;
+  name: string;
+  type: string;
+  size?: number;
+  url?: string;
+} | {
+  uri: string;
+  missing: true;
+};
 /** A reference to a record created earlier in the same batch (`ref` on its `create`). */
 export type BatchRef = {
   $ref: string;

package/dist/upload-request.d.ts

@@ -0,0 +1,4 @@
+//#region src/upload-request.d.ts
+/** Bytes sent so far, of `total`. */
+export type UploadProgress = (sent: number, total: number) => void;
+//#endregion

package/dist/upload-request.js

@@ -0,0 +1,30 @@
+//#region src/upload-request.ts
+const headersOf = (raw) => new Headers(raw.trim().split(/[\r\n]+/).filter(Boolean).map((line) => {
+	const colon = line.indexOf(":");
+	return [line.slice(0, colon).trim(), line.slice(colon + 1).trim()];
+}));
+/**
+* A `fetch` that reports upload progress, through XMLHttpRequest since fetch cannot. It answers with an ordinary
+* Response; a network failure rejects with a TypeError, as fetch does.
+*/
+const fetchWithProgress = (onProgress) => (input, init = {}) => new Promise((resolve, reject) => {
+	const request = new XMLHttpRequest();
+	request.open(init.method ?? "GET", String(input));
+	new Headers(init.headers).forEach((value, name) => request.setRequestHeader(name, value));
+	request.responseType = "blob";
+	request.upload.onprogress = (event) => onProgress(event.loaded, event.lengthComputable ? event.total : event.loaded);
+	request.onload = () => {
+		const empty = request.status === 204 || request.status === 304;
+		resolve(new Response(empty ? null : request.response, {
+			status: request.status,
+			statusText: request.statusText,
+			headers: headersOf(request.getAllResponseHeaders())
+		}));
+	};
+	request.onerror = () => reject(/* @__PURE__ */ new TypeError("Network request failed"));
+	request.onabort = () => reject(new DOMException("The upload was aborted", "AbortError"));
+	init.signal?.addEventListener("abort", () => request.abort());
+	request.send(init.body);
+});
+//#endregion
+export { fetchWithProgress };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.7.0",
-    "@protobase/schema": "0.7.0",
+    "@protobase/layout": "0.8.0",
+    "@protobase/schema": "0.8.0",
     "better-auth": "^1.7.7"
   }
 }